CVE-2026-103529
Received Received - Intake

Authenticated Admin RCE via Malicious Module Upload in Thelia

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103529
EUVD
EUVD-2026-97481

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thelia v2.6.0 allows authenticated administrators to upload and install modules via ZIP upload without validating or sandboxing embedded PHP code. Attackers can include malicious PHP code in a module's install() method, which executes upon installation, leading to remote code execution with the web server's privileges.

Impact Analysis

An attacker with administrator access could exploit this to execute arbitrary code on the server, potentially taking full control of the system, stealing data, or disrupting services. Even with limited access, this could escalate privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Thelia to a version that validates and sandboxes PHP code in uploaded modules. Restrict administrative access to trusted users only. Monitor for unauthorized module installations or PHP execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103529. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart